Science and Technology : FUD: Lies, D@mn Lies and Statistics

[anAfrican]

i'm rather hesitant to try to point out articles about the vulnerabilities in microsoft products. on the one hand, i'd be here all day. on the other, i'd have to deal with the responses from people that haven't spent over 20 years buried in the innards of puters.

and, yet, on another hand; not trying to point out the vulnerablities, and solutions/alternatives, to something as dangerous to privacy as the microsoft platform is highly irresponsible. and most definitely does not fit under the heading of "showing love for my family".

this is a "rebuttal" on this year's "software vulnerability list". as always, the list is skewed to show microsoft out on top. but there is a catch; many of the "vulnerabilities" listed for other operating systems are listed multiple times. further, there are a lot more variants of "unix" than there are of windows, but those are the two categories listed. <sigh> the FUD (fear, uncertainty and doubt) continues ...

On CERT's 2005 Software Vulnerabilities List
Saturday, December 31 2005 @ 03:48 PM EST

CERT has released its list of software vulnerabilities for 2005. Brian Krebs on his blog, Security Fix, reports:

Security researchers uncovered a record 5,198 vulnerabilities in software products this year, nearly 38 percent more than the number of flaws found in 2004, according to statistics published by US-CERT, a cyber security information-sharing collaboration between the Department of Homeland Security and the CERT Coordination Center at Carnegie Mellon University in Pittsburgh.

Well, yes and no. Let me explain what I see.

Already some are trying to spin the list to try to imply that Microsoft has so many vulnerabilities, 812, because of its popularity. The way CERT has published the list, however, makes any comparison questionable, at least using this list as currently organized.

First, this is a list of vulnerability reports, and it lists them in the following categories: Microsoft Operating System, and Multiple Operating System, and Unix/Linux Operating System. The last category means that AIX and Apple and FreeBSD and Solaris and Linux and ... gulp, ironically enough ... SCO OpenServer and UnixWare vulnerabilities ... are all lumped together, for a total of 2328, making a direct comparison between Microsoft and anyone else nearly impossible.

Second, the Unix/Linux list duplicates items, counting a vulnerability more than once in the list. For an example, note that it lists Eric Raymond Fetchmail POP3 Client Buffer Overflow (Updated). However, the same vulnerability is listed, under the same title, four times. That's because it was reported in the week of August 10-15, again in the week of August 17-23, in September 6-13, and the week of November 9-16. Worse, for any comparison purposes, the same vulnerability is also reported as Fetchmail POP3 Client Buffer Overflow, so in reality one vulnerability is listed 5 times, making the total of 2328 meaningless unless you carefully comb through it to weed out duplications.

All the links take you to the same description of the same vulnerability, CVE-2005-2335, which tells you that there are no known exploits for this vulnerability. So another issue with the list is that there is no distinction made between truly widespread issues that caused real-life damage and vulnerabilities someone noticed but no one ever exploited. There is a difference.

for even more fun; here are a couple of "amusing" blog entries regarding some of the insecurity of windows:

DO NOT CLICK ON THE LINK THAT THESE BLOGS TELL YOU NOT TO CLICK ON IF YOU ARE RUNNING INTERNET EXPLORER ON ANY FLAVOR OF WINDOWS!!! YOUR COMPUTER WILL BE IMPACTED!! IT WILL NOT BE PRETTY!! THE EXPLOIT DOES WORK!

What Part of Virus and Spyware Didn’t You Understand?

Helios Extracts Microsoft Stupid Tax From Windows User

here is the current Twenty Most Critical Internet Security Vulnerabilities (Updated) at the SANS Institute. it might not be a bad idea to spend an afternoon browsing through this list, as well as the pointers to methods to mitigate these issues.